Critical source files have at least one corresponding test

Auth, payment, billing, and webhook handlers are the highest-risk code in any commercial application — bugs there cause account takeovers, double-charges, missed payments, and data exposure. CWE-1059 (Insufficient Documentation) and ISO-25010:2011 testability both flag untested critical paths as systemic risk. An AI agent generating a Stripe checkout route or a JWT auth handler without writing a corresponding test file leaves the most consequential code in the project completely unverified. A single refactor in lib/billing.ts with no test coverage can silently break revenue collection.

Create a test file for every file under lib/auth*, lib/payment*, lib/billing*, app/api/auth/, app/api/checkout/, and app/api/webhooks/. The test doesn't need to be exhaustive — one covering the happy path is enough to break the pattern:

// tests/billing.test.ts
import { calculateInvoice } from '@/lib/billing'

describe('calculateInvoice', () => {
  it('applies tax to line item total', () => {
    const result = calculateInvoice([{ price: 100, qty: 2 }], 0.1)
    expect(result.subtotal).toBe(200)
    expect(result.tax).toBe(20)
    expect(result.total).toBe(220)
  })

  it('returns zero total for empty items', () => {
    const result = calculateInvoice([], 0.1)
    expect(result.total).toBe(0)
  })
})